Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following:


I've installed a signed one into the GAC and also tried the App_Code directory and neither has worked. I've also tried setting the


registry entry to 1 and still nothing.

EDIT: I've also tried this: Community ISAPI filter

Is there any possible way to do this?


1 Answer 1


I've tried adding the following to my application-level "Web.Config" file with varying degrees of success:

        <remove name="ETag" />
        <remove name="Server" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
        <remove name="X-Powered-By" />

This only applies to content served out of the application directory (and subdirectories) and doesn't work when applied to the "applicationHost.config" file underneath the "System32/inetsrv/config" directory. I've also had this change not work at all (how I came across your question here while researching this issue), so your mileage may vary.

  • Doesn't remove the Server header
    – jjxtra
    May 18, 2012 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .